Skip to content

Fix desktop release updater signing flow #187

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
wesbillman merged 1 commit into from
Mar 25, 2026
+8 −7
Merged

Fix desktop release updater signing flow #187

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions desktop/RELEASING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ The `sprout-desktop-release.yml` workflow:
`Cargo.toml` using `set-version-from-tag.mjs`.
3. **Regenerates `Cargo.lock`** to match the patched `Cargo.toml`.
4. **Validates** all required secrets are present.
5. **Builds** the release config with signing and updater settings.
5. **Builds** the release config with the updater public key and endpoint.
6. **Builds** the Tauri app (unsigned).
7. **Signs and notarizes** the macOS bundle via `block/apple-codesign-action`.
8. **Re-packages** the signed app into a DMG and updater archive.
Expand All @@ -89,7 +89,7 @@ The `sprout-desktop-release.yml` workflow:

Local builds will not be codesigned or notarized — that only happens in CI
via `block/apple-codesign-action`. Local builds are useful for testing the
updater config and DMG packaging.
updater runtime config and DMG packaging.

```bash
# Set updater env vars
Expand Down Expand Up @@ -167,3 +167,8 @@ tag drives the version.
- **Build failures**: If versions are wrong, check that the tag follows the
format `desktop/v<semver>` (e.g. `desktop/v0.3.0`). CI extracts the version
from the tag automatically.

- **"A public key has been found, but no private key"**: The Tauri build should
not require `TAURI_SIGNING_PRIVATE_KEY`. If you see this, the build is trying
to generate updater artifacts before the signed app bundle exists. The updater
archive is supposed to be created and signed later from the notarized app.
6 changes: 1 addition & 5 deletions desktop/scripts/build-release-config.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,17 +13,13 @@ const baseConfig = JSON.parse(readFileSync(baseConfigPath, "utf-8"));

const releaseConfig = { ...baseConfig };

releaseConfig.bundle = {
...(releaseConfig.bundle ?? baseConfig.bundle ?? {}),
createUpdaterArtifacts: "v1Compatible",
};

releaseConfig.bundle.macOS = {
...(releaseConfig.bundle?.macOS ?? baseConfig.bundle?.macOS ?? {}),
minimumSystemVersion: "10.15",
};

if (publicKey && endpoint) {
// Build-time updater artifacts are created later from the signed app bundle.
releaseConfig.plugins = {
...(baseConfig.plugins ?? {}),
updater: {
Expand Down
Loading